{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bb1c6129-a181-5a4b-a0c8-5e989ff9935c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10", "version": "4.3.30.RELEASE-tuxcare.10", "pedigree": { "ancestors": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.30.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:38144739-6fc2-5ef5-a56f-937ad9e224a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:de48fed4-6a42-5834-93a8-873ee5d5baed", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm. CVE-2020-5397 doesn't affect spring-framework 4.3.30.RELEASE", "justification": "code_not_present" } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:1fa5f73c-b056-5da0-9a64-a9c8ebc3026f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5421 does not affect version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm. Version 4.3.30.RELEASE is not affected by CVE-2020-5421: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: 6327c60912cd80120040c8c16c3731d8bf6c19f6\". No backport needed." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:40cc7012-15a4-502c-9de6-ffe0ca20a9da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:a2b61f87-f5b4-5047-aed6-00a00c31a5db", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22096 does not affect version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm. CVE-2021-22096 fix already exists in commit 4895b739b3e5fea63ecb01ac867c136add560cf6", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:69a6f471-a7c1-588b-a69e-bc791bae816a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm. Version 4.3.30.RELEASE is not vulnerable. Summary: Target repository is Spring Framework 4.3.30.RELEASE-tuxcare.2, which predates the introduction of WebFlux. The vulnerable code (reactive multipart handling with predictable temp directories) does not exist in this version. CVE-2021-22118 specifically affects WebFlux applications in Spring Framework 5.2.x prior to 5.2.15 and 5.3.x prior to 5.3.7. WebFlux was introduced in Spring Framework 5.0, and the vulnerable multipart han [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:0b6eed00-002d-51f6-82c0-4a605bc4af58", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:9b6ad1ae-43f6-51e9-bdd3-e94070505b1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:c72c84ab-06be-5e85-bba1-adc9da3d7af6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:8c7f695b-1672-542c-b0c2-4f504aaf5785", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:50b480d1-858b-5568-9f56-2d7bcb176576", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:e72b65fa-3ae9-547d-9f50-078be9c03fad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:19516323-d45c-51a0-9c53-e76315fe00dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:2f01a8a3-8e36-5fca-bace-c3a9aa7b7dac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:1cd6de58-6b60-53e4-abfc-57e20835f248", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:031ef798-3973-5242-840b-33890cbaf92c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:421ba62b-6a52-5259-b2ac-620552196b4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:585270df-69f4-598f-a664-c8fd7ca9097c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:1ad55a00-2ae8-5f99-9880-d84685a483d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:69d16328-edc5-570a-8ead-f8f2c4e42026", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:25e6d8ee-deef-57c2-a4cf-c0587206abb6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:f9c6b24a-238c-5a5d-b11d-555890f66755", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:350c2bb3-5029-50af-a56f-103ac8e88b79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:5d433ed6-a069-56b5-bd48-47a03b3ccc43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:7687fd65-776a-58fe-92a6-fde307f7bd14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:37307822-858a-5e34-91e3-fed665ff7497", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:227ab5c0-875e-52fc-9fdd-282b9031b4bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:db8096a5-5d1d-59c0-b126-b0891d285495", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm. CVE-2026-22740 is a WebFlux-specific vulnerability (reactive multipart temp-file cleanup in org.springframework.http.codec.multipart.MultipartHttpMessageReader / PartGenerator). Spring Framework 4.3.30.RELEASE predates WebFlux entirely - the org.springframework.http.codec package does not exist in this version, and there is no reactive multipart code path. Per NVD, affected versions are 5.3.x, 6.1.x, 6.2.x, 7.0.x only; Spring 4.x is not in the affected range.", "justification": "code_not_present" } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:69b55f32-4687-5425-b781-5d1b95e3c863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:e677323b-fd17-5dcd-bd8f-acb93d629de4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:faac752b-3c8f-55ca-b3ca-5fc7c1d1a066", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:47d920b2-06b2-5f09-ae03-e5574d7289eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:eda8c279-2783-5804-8d3f-ba1489f8c8ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:d09d9cd1-8c47-50e0-9ae7-1afef6481dd5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:01ae0cd8-1a76-52b2-bc8d-a86cd2a29279", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:782c438f-5dcf-5139-9110-caf1e572a525", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:efdf0ed5-7b0c-534f-9d4f-d5896c908e07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:7a542363-3766-5b58-8966-63f3f003bb46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:d138090a-34a8-546b-be69-c057f7a6a745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:5811a87b-1e38-584c-b869-d18ea0479c9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:078708dd-4ee4-577d-a2a4-c2f4681375fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:df80568a-1ecc-564e-82e5-e4002c286719", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:99569d2e-f40a-59d7-9694-a2f14991bc22", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm. not_affected \u2014 Spring Framework 4.3.30 is not affected by CVE-2026-41853. This version predates Spring WebFlux (introduced in 5.0) and lacks the vulnerable component DefaultServerWebExchange.java. The vulnerability mechanism - Spring Framework's message reader selection based on wildcard Content-Type headers - does not exist in this servlet-based Spring MVC architecture.", "justification": "code_not_present" } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:66fa2228-2252-5876-a4f5-555b0e2b207e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:ee2bd3b3-5e5e-509c-bc50-4a0d52c5b7d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:b38f4b92-a85f-5800-a8c5-4f0f7806d075", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:f21cb97e-a3a0-52fa-8f93-d9a62a0f5881", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:77d86bd4-9e75-5f80-8fa7-20e4c4281f8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:81ff38b4-feee-5e10-8f50-40f1184a949b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:074f878e-10f5-5848-89c5-1232aaa1378d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:08c24324-2974-5dd9-a350-215ea91af370", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:ea63f1a9-a6b3-5ada-a91d-0df0f8620292", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:1eabc81b-69e0-5728-9999-7ac26ff08ae9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-orm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.10" } ] }